What you're trying to do is restrict your results in your SQL query. It should look like this: | dbquery "MYDB" "SELECT text_field FROM my_table WHERE text_field LIKE '%Description%' " The "LIKE" command searches for any string that contains the string you feed it. The "%" character is a wildcard, so %description% will match any text field that contains the string 'description'. Also be sure to verify the correct use of SQL quotes within your Splunk search. Here's a simple manual page on the subject: http://www.techonthenet.com/sql/like.php ... View more

Ok I think I answered my own question - was simpler than I thought (must have just been missing something small): | dbquery "DBNAME" "SELECT useraction FROM usertable" | eval useraction=strftime(useraction,"%Y-%d-%m") | stats count by useraction ... View more